protocol-reverse-engineering

Capture multiple traffic sessions with tcpdump or Wireshark, identify message boundaries and magic bytes, then compare samples to map header fields like length, type, and sequence numbers. Validate your understanding by writing a Python parser with struct and documenting the format.

Use tcpdump -i eth0 -s 0 -w capture.pcap to record full packets to a file, or tshark for ring-buffer rotation. Open the pcap in Wireshark to apply display filters, follow TCP streams, and export objects for deeper analysis.

Calculate byte entropy of the payload: values above 7.5 bits per byte suggest encryption or randomness, while below 6.0 indicates plaintext or structured data. Also check for TLS record headers (0x16 0x03) and block-aligned lengths typical of AES.

Yes, if you have the session keys. Set the SSLKEYLOGFILE environment variable in the browser to log pre-master secrets, then point Wireshark's TLS preferences to that file. RSA private key decryption only works for non-ephemeral key exchanges.

Define a Proto object with ProtoFields for each header field, implement a dissector function that reads offsets from the buffer, and register it via DissectorTable for a specific TCP port. Wireshark then decodes matching packets automatically.

Replayed packets fail when protocols use sequence numbers, timestamps, nonces, or session tokens that must be fresh. You must modify these fields and recalculate IP and TCP checksums before sending, or the target will reject the traffic.